chore: bootstrap repo skeleton with sprint 0 plan

- .gitignore (Python, Node, RT/maldev hygiene, secrets)
- README.md (project framing, stack, conventions, status)
- CHANGELOG.md (team kickoff decisions Q1/Q2/Q3, T2/T3/T4, auth strategy)
- tasks/spec-decisions.md (D-001..D-007 arbitrations on top of frozen spec)
- tasks/todo.md (sprint 0 backlog: B0.* / F0.* / S0.* / R0.*)
- tasks/lessons.md (empty, populated as work progresses)
- backend/ frontend/ docs/ scaffolding

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -0,0 +1,56 @@
+# Mimic
+
+Internal BAS (Breach & Attack Simulation) platform for the Red Team.
+Replays TTPs from engagement journals or an internal ATT&CK library against
+client infrastructure through VPN/relay, in white-glove coordination with the SOC.
+
+**Output**: a coverage report mapped to MITRE ATT&CK — measurable, reproducible, archived.
+
+## Status
+
+`ready-with-prereqs` — spec frozen on 2026-05-19, 23 review patches integrated.
+Code start blocked on:
+
+- **PR1** — Mythic API documentation + pinned version (lead RT)
+- **PR2** — Internal C2 interface spec + journal export example (internal C2 team)
+- **PR3** — RT graphic charter for the PDF report (lead RT)
+
+While PR1/PR2/PR3 are open, sprint 0 focuses on the unblocked skeleton.
+
+## Spec
+
+The authoritative spec lives in the RT-SecondBrain vault:
+`Projects/Mimic — Spec.md`. Do not duplicate it here.
+
+In-repo documentation:
+
+- `CHANGELOG.md` — chronological log of features, decisions, rollbacks.
+- `tasks/spec-decisions.md` — implementation arbitrations on top of the spec.
+- `tasks/todo.md` — current sprint backlog.
+
+## Stack (frozen)
+
+- **Backend** Python 3.12 / Flask / Flask-SocketIO / SQLAlchemy 2 / Pydantic 2 / Alembic / WeasyPrint / pytest + testcontainers / ruff / mypy strict
+- **Frontend** TypeScript / React 18+ / Vite / Tailwind 4 / TanStack Query 5 / Recharts / Playwright
+- **Storage** Postgres (prod) / SQLite (unit tests only)
+- **Deploy** Docker + Ansible
+
+## Layout
+
+```
+mimic/
+├── backend/    # Flask app, connectors, orchestrator, reporting, CLI
+├── frontend/   # Vite + React app
+├── docs/       # Architecture notes, ADRs, deployment
+└── tasks/      # Sprint backlog, decisions, lessons
+```
+
+## Conventions
+
+- Branches: `feature/<scope>`, `fix/<scope>`, `docs/<scope>`, `chore/<scope>`. Long-lived: `main`.
+- Commits: Conventional Commits (`feat:`, `fix:`, `chore:`, `docs:`, `test:`, `refactor:`).
+- PRs: each branch → review (`code-reviewer`) → team-lead merges. No direct push to `main`.
+
+## Build & run
+
+`make` targets land at the end of sprint 0. For now the repo is skeleton-only.